Personal data protection policy

Data controller

In compliance with the provisions of Law 1581 of 2012 on Personal Data Protection and other regulations governing the matter, FUNDICIONES MODELOS Y MOLDES S.A.S. – FUNDIMOLDES S.A.S., hereinafter FUNDIMOLDES S.A.S., domiciled at Carrera 72 J Bis No. 34 – 74 Sur, Bogotá D.C., Colombia, with website www.fundimoldes.com, acting as controller of the processing and protection of personal data, presents this Personal Data Protection Policy for the information of its (I) users, (II) customers, suppliers and others, (III) employees, interns, apprentices and job applicants, (IV) visitors and website visitors, and (V) data subjects in general.

What personal data will we use?

Depending on the existing legal relationship, various data of data subjects may be processed, such as: identification data, contact data, asset and/or financial data, employment data, academic data and biometric data, among others. Likewise, where relevant to the performance of the activities of FUNDIMOLDES S.A.S., specific information regarding health or physical conditions.

For what purposes will we use your personal data?

In general, the information collected will be incorporated into the database of FUNDIMOLDES S.A.S., and its purposes will be the following:

ICustomers, suppliers and others

Personal data requested to establish a potential business relationship with customers, suppliers and others will have the following purposes:

1. To provide the services and/or supply the products rendered and/or distributed by FUNDIMOLDES S.A.S.
2. To present, inform about, communicate and offer services and/or products of FUNDIMOLDES S.A.S.
3. To inform, communicate, organize, control, handle and certify activities related to your status as a Customer, Supplier or Third Party of FUNDIMOLDES S.A.S., including reports to oversight and supervisory authorities.
4. To establish and manage the pre-contractual, contractual and post-contractual relationship of a commercial, employment, civil or any other nature arising from the fulfillment of a legal or contractual obligation with FUNDIMOLDES S.A.S.
5. To make the respective accounting and tax records and manage payments and collections.
6. To confirm the personal information provided by cross-checking it against public databases, credit bureaus and risk prevention systems, specialized companies, references and contacts.
7. To consult and/or verify your information against national and international watch lists related to Money Laundering and Terrorist Financing, unlawful activities or situations regulated by the Colombian Criminal Code.
8. To achieve efficient commercial, marketing and statistical communication regarding the services and/or products rendered or sold by FUNDIMOLDES S.A.S.
9. To consult your information for surveys, market research, evaluations and/or quality follow-up of the services and/or products rendered or delivered by FUNDIMOLDES S.A.S.
10. To report substantial changes to the Personal Data Processing Policy of FUNDIMOLDES S.A.S.
11. To disclose your personal data to judicial and/or administrative entities and/or authorities when required and necessary for the performance of their functions.
12. To send information about promotions, events and commercial offers related to the services and/or products of FUNDIMOLDES S.A.S. or any of its brands, business units and/or commercial establishments.
13. To transmit or transfer personal data within or outside Colombian territory, regardless of the level of protection of the receiving country.
14. To serve as an access control mechanism for the facilities of FUNDIMOLDES S.A.S.

IIEmployees, apprentices, interns and job applicants

In the case of data requested from job applicants, employees, apprentices and interns of FUNDIMOLDES S.A.S., the personal data will have the following purposes:

1. To inform, communicate, organize, control, handle and certify activities related to your status as an Employee, Apprentice, Intern or Job Applicant of FUNDIMOLDES S.A.S.
2. To establish and manage the employment, contractual or regulatory relationship of the Employee, Apprentice, Intern and Applicant with FUNDIMOLDES S.A.S.
3. To carry out evaluations for hiring and performance, personnel selection processes, business consulting, training, coaching and measurement of indicator compliance, as well as socioeconomic studies and the administration of all types of aptitude and competency tests.
4. To manage the information in your résumé and other information for the fulfillment of the obligations of FUNDIMOLDES S.A.S. as an employer and all other activities and processes of the Human Resources Department.
5. To respond to inquiries, requests or claims submitted by Employees, Apprentices, Interns and Applicants through the channels authorized by FUNDIMOLDES S.A.S. for that purpose.
6. To report substantial changes to the Personal Data Processing Policy of FUNDIMOLDES S.A.S.
7. To confirm the personal information provided by cross-checking it against public databases, credit bureaus and risk prevention systems, specialized companies, references and contacts.
8. To consult and/or verify your information against national and international watch lists related to Money Laundering and Terrorist Financing, unlawful activities or situations regulated by the Colombian Criminal Code.
9. To disclose your personal data to judicial and/or administrative entities and/or authorities when required and necessary for the performance of their functions.
10. To send information about promotions, events and commercial offers related to the services and/or products of FUNDIMOLDES S.A.S. or any of its brands, business units and/or commercial establishments.
11. To transmit or transfer my personal data within or outside Colombian territory, regardless of the level of protection of the receiving country.
12. To serve as an access control mechanism for the facilities of FUNDIMOLDES S.A.S.
13. To send information about courses, seminars and training sessions held by FUNDIMOLDES S.A.S. and by third parties.

IIIVisitors

Data requested from visitors will be used to maintain access control and to safeguard the security of the facilities and employees and the confidentiality of information owned by FUNDIMOLDES S.A.S.

IVWebsite visitors

Data requested from visitors to the website www.fundimoldes.com may be used for the following purposes:

1. To register you in the programs you have voluntarily signed up for and to send the requested information or information about FUNDIMOLDES S.A.S. and/or its products and/or services.
2. To inform you about promotions, events and activities in general that may be of interest to you.
3. To respond to requests, questions or comments.
4. To create and manage your account, if this mechanism is implemented and the data subject decides to create one.
5. To record information in order to send information of interest about FUNDIMOLDES S.A.S. or a particular topic.

How will your personal data be processed?

Personal information will be used or processed for the purposes stated in this Policy. FUNDIMOLDES S.A.S. may process the data on its own servers or on servers provided by a specialized third party, which may be located in Colombia or in other countries, in which case it will ensure that agreements are in place establishing the obligations those third parties must observe, in addition to requiring compliance with the Personal Data Protection Policies of FUNDIMOLDES S.A.S.

Personal Data is collected in compliance with all the principles established by Law, such as lawfulness, quality, consent, restricted access and circulation, information, purpose, fairness, security, proportionality and accountability.

Personal Data is obtained directly from the data subject in person or through optical, audio or visual means, or through any other legally permitted technology, including email and the website.

In addition, FUNDIMOLDES S.A.S. may obtain information from other sources permitted by law, such as telephone directories, references from other companies or individuals, public databases, and providers that deliver information in the exercise of their legally established activities.

The processing of personal data collected directly by FUNDIMOLDES S.A.S. is carried out on the basis of authorization obtained through any means that allows it to be consulted later, including technological or other mechanisms that make it possible to conclude unequivocally, from the data subject’s own conduct, that the data was captured and stored in the database with their approval.

In carrying out its functions, FUNDIMOLDES S.A.S. may rely on the support of third parties who will, on occasion, have access to certain personal information. In such case, FUNDIMOLDES S.A.S. is committed to:

1. Entering into Agreements with the third parties that will process the information, setting out their confidentiality and security obligations in processing it, which will be similar to those established by FUNDIMOLDES S.A.S. in its processes.
2. Providing the third party only with the information strictly necessary to perform its functions on behalf of FUNDIMOLDES S.A.S.

How will information disclosed to third parties be handled?

As set out in the purposes for which personal information is collected and processed, in carrying out its functions FUNDIMOLDES S.A.S. may rely on the support of third parties who will, on occasion, need access to certain personal information. In such case, FUNDIMOLDES S.A.S. is committed to ensuring:

1. That every disclosure of information to a third party will be preceded by an Agreement setting out its confidentiality and security obligations in processing the information, which will be at least similar to those established by FUNDIMOLDES S.A.S. in its processes.
2. That the third party will receive only the information strictly necessary to perform its functions on behalf of FUNDIMOLDES S.A.S.

How will security information, video recordings and communications be handled?

As part of its policies on quality, security, monitoring of its activities, entry and exit controls at its offices, and updating or supplementing the information held in its databases, FUNDIMOLDES S.A.S. may make video recordings in its offices and common areas of its facilities. Such recordings will be kept in the files of FUNDIMOLDES S.A.S. for a maximum of ninety (90) days and will then be erased or destroyed.

When FUNDIMOLDES S.A.S. uses images of its employees in materials promoting activities within its corporate purpose, it requests their authorization. FUNDIMOLDES S.A.S. generally does not use images or audio files of its customers, suppliers or partners; however, as part of its communication strategy it may use such files, with the prior authorization of the data subject, exclusively for presenting and disseminating its programs and projects. Accordingly, FUNDIMOLDES S.A.S. undertakes to carefully review any information to be published in any form, so as never to infringe upon the dignity, privacy or good name of any person who may appear in its communications. The provision of information by data subjects in any form does not transfer to FUNDIMOLDES S.A.S. the intellectual property or moral rights over it. Intellectual property rights will remain with the data subject.

When a person provides FUNDIMOLDES S.A.S. with personal information of third parties, such as employment or personal references or prospective customers, the person providing it is obligated to ensure they have all authorizations from the respective data subjects; accordingly, FUNDIMOLDES S.A.S. will not be responsible for any of the content provided to it, although it reserves the right to use or delete it in accordance with its personal data protection policies.

How will the data of minors be processed?

In accordance with the personal data protection regulations in force in Colombia, FUNDIMOLDES S.A.S. respects and provides guarantees so that minors can exercise their rights to freedom of expression, free development of their personality and information. FUNDIMOLDES S.A.S. generally does not process personal data of minors. However, should their use be required, it will be carried out in compliance with the following parameters and requirements:

1. Respect for the best interests of children and adolescents.
2. Respect for their fundamental rights.

Accordingly, it guarantees that answering any question concerning minors will be optional for their legal representative or guardian, and it reserves the right to report to the authorities any situation that, in the opinion of FUNDIMOLDES S.A.S., may endanger or endangers the integrity of a minor.

How will sensitive data be processed?

This personal information falls into a special category because it relates to confidential medical data, information on race or ethnic origin, religious beliefs, political ideology, sexuality, displacement or disaster circumstances, and biometric data. Should this type of information be required for the proper performance of the activities carried out by FUNDIMOLDES S.A.S., data subjects must grant their express authorization.

FUNDIMOLDES S.A.S. accepts that answering questions is optional when they concern sensitive data or the data of children and adolescents, unless such information is absolutely required to take actions for the benefit of the data subject.

How can you access, rectify or cancel your personal data, or object to its use?

In accordance with current Colombian legislation, in particular the Political Constitution and Law 1581 of 2012, data subjects, their legal representatives or their successors in title have the right to:

For inquiries made more than once per calendar month, FUNDIMOLDES S.A.S. may charge the data subject for shipping, reproduction and, where applicable, document certification costs. It should be noted that deletion of the data, where it is feasible to grant such a request, will mean that the data cannot be accessed for the company’s normal operations; however, it may be retained in its files for statistical or historical purposes, or to respond to requests from administrative or judicial authorities.

If the request made by the data subject or their successors in title concerns existing authorizations for the processing of data collected by third parties who share it with FUNDIMOLDES S.A.S., the company will make its best efforts to handle the request appropriately and, if unable to do so, will forward the request to the third parties responsible for collecting the information. However, in such cases it will not be responsible for the content of the responses given to the requests.

What is the procedure for submitting petitions, complaints, inquiries and claims?

Data subjects or their successors in title may consult the personal information of the Data Subject held in any database of FUNDIMOLDES S.A.S. Accordingly, FUNDIMOLDES S.A.S. will guarantee the right of inquiry by providing data subjects with all information linked to the identification of the Data Subject.

Inquiries

Inquiries must be submitted through one of the contact channels described in this document, following the procedure below:

1. At any time and free of charge, the data subject or their representative may submit inquiries about the personal data processed by FUNDIMOLDES S.A.S., upon proof of their standing.
2. When the inquiry is submitted by a person other than the data subject, their legal standing or authority to act must be duly proven.
3. The inquiry must contain at least the following information:
   1. The name and contact address of the data subject or any other means of receiving the response.
   2. The documents proving the identity and capacity of their representative, as indicated in the following cases:
      • Data subject: Identity document.
      • Successor in title: Civil registry record and identity document.
      • In the case of minors:
        • Parents: Birth certificate (civil registry) and identity document.
        • Guardians: Court ruling granting legal representation.
      • Legal representative authorized by the data subject: Notarized power of attorney.
   3. A clear and precise description of the personal data regarding which the data subject seeks to exercise the right of inquiry.
   4. A clear and precise description of the inquiry made by the data subject, their successors in title or representatives.
   5. Supporting documentation for the request, where appropriate given the nature of the data.
   6. Where applicable, other elements or documents that help locate the personal data.
4. If the inquiry made by the data subject is incomplete, FUNDIMOLDES S.A.S. will ask the interested party, within five (5) days of receiving the inquiry, to correct the deficiencies. If two (2) months elapse from the date of that request without the applicant submitting the required information, the inquiry will be deemed withdrawn.
5. For complete inquiries, a response will be given to the petitioners within ten (10) business days from the date of receipt. When it is not possible to address the inquiry within that period, the interested party will be informed, stating the reasons for the delay and indicating the date on which the inquiry will be addressed, which in no case may exceed five (5) business days after the first period expires.

Claims (correction, update, deletion)

A Data Subject or their successors in title who consider that information contained in a database should be corrected, updated or deleted, or who notice an alleged breach of any of the duties set forth in the Law, may file a claim through one of the contact channels described in this Policy, following the procedure below:

1. At any time and free of charge, the data subject or their representative may file claims regarding the correction, update or deletion of the personal data being processed, upon proof of their identity and standing.
2. When the claim is filed by a person other than the data subject, their legal standing or authority to act must be duly proven.
3. The inquiry, rectification, update or deletion request must contain at least the following information:
   1. The name and contact address of the data subject or any other means of receiving the response.
   2. The documents proving the identity and capacity of their representative, as indicated for the following cases:
      • Data subject: Identity document.
      • Successor in title: Civil registry record and identity document.
      • In the case of minors:
        • Parents: Birth certificate (civil registry) and identity document.
        • Guardians: Court ruling granting legal representation.
      • Legal representative authorized by the data subject: Notarized power of attorney.
      • By stipulation in favor of another: A statement to that effect.
   3. A clear and precise description of the type of claim made by the data subject (correction, update or deletion).
   4. A clear and precise description of the personal data regarding which the data subject seeks to exercise the right to file a claim, as well as the facts giving rise to it.
   5. Supporting documentation for the request, where appropriate given the nature of the data.
   6. Where applicable, other elements or documents that help locate the personal data.

If the claim made by the data subject is incomplete, the interested party will be asked, within five (5) days of receipt of the claim, to correct the deficiencies. If two (2) months elapse from the date of that request without the applicant submitting the required information, the request will be deemed withdrawn.

For claims (corrections, updates and deletions), a response will be given to data subjects within fifteen (15) business days from the date of receipt of the claim. When it is not possible to address the claim within that period, the interested party will be informed, stating the reasons for the delay and indicating the date on which the request will be addressed, which in no case may exceed eight (8) business days after the first period expires.

Contact channels

To exercise the right to submit inquiries, claims, corrections, updates or deletion of personal data, the data subject may contact FUNDIMOLDES S.A.S. through the following channels:

The above contact channels are without prejudice to the right of FUNDIMOLDES S.A.S. to establish additional contact mechanisms, which will be published or announced on its website.

Third-party information

FUNDIMOLDES S.A.S. reiterates that the receipt of information provided by third parties must be preceded by the appropriate authorizations on their part. Accordingly, FUNDIMOLDES S.A.S. understands that whoever provides information (whether a public or private person) for the performance of activities within its corporate purpose has all the relevant authorizations for that purpose, where required under Law 1581 of 2012, and that the purposes for which it is provided have been fully disclosed to and accepted by the data subject; and in that sense, releases FUNDIMOLDES S.A.S. from any liability for the use it makes of the data in accordance with the purposes for which the information is provided, and in the event of any claim, whether civil, administrative or criminal, will answer to any summons made for that purpose. The foregoing is on the understanding that FUNDIMOLDES S.A.S., in the course of its internal policies or by order of a competent authority, may require proof of such authorizations.

Accuracy of and changes to the information provided

The information shared by the data subject with FUNDIMOLDES S.A.S. must be complete, current and truthful, and any discrepancy between the data provided and reality is the sole responsibility of the person providing it. Any change to the Information provided to FUNDIMOLDES S.A.S. must be notified to it within five (5) business days after the occurrence of the events that led to the change in the data, through any of the channels provided for that purpose.

Amendments to the Personal Data Protection Policy

FUNDIMOLDES S.A.S. reserves the right to amend the personal data protection policy at any time. To that end, it will publish a notice on its website ten (10) business days before the amendment takes effect. If data subjects or their representatives disagree with the new personal data protection Policies for valid reasons that constitute just cause, they may request that FUNDIMOLDES S.A.S. remove their information through the channel indicated above; however, removal of the data may not be requested while any kind of relationship with FUNDIMOLDES S.A.S. remains in place.

Governing law, jurisdiction and term

Any interpretation and any judicial or administrative action arising from the processing of the personal data in the databases of FUNDIMOLDES S.A.S. will be subject to the personal protection regulations established in the Republic of Colombia and by the competent administrative or judicial authorities; the same applies to the resolution of any question, complaint or lawsuit concerning them.

The information in our databases will continue to be processed by FUNDIMOLDES S.A.S. for the period necessary to carry out its programs or for as long as a legal or contractual relationship with the data subject remains in place. In any event, as a general rule, the information will not be processed for a period exceeding thirty (30) years from the authorization, except for legal or contractual circumstances or circumstances related to the pursuit of its corporate purpose that make handling the information necessary, without prejudice to it being retained, in any case, where necessary to carry out statistical or historical tasks or to comply with any legal obligation.

Website

The FUNDIMOLDES S.A.S. website may use analytics technologies, including web beacons or other web bugs, through which it is possible to analyze your behavior as an Internet user on our website, in order to provide you with better service and a better user experience when browsing our website, as well as to offer you new products and services based on your preferences. We will use the personal data we collect through these technologies for the following purposes:

1. To perform analytics and statistics on our website.
2. To improve the service, quality and performance of our website.
3. To offer new products and services based on your preferences.
4. The personal data we obtain from these analytics technologies is the following:
   1. Technical characteristics of the user’s device.
   2. The user’s preferred language.
   3. The region where the user is located.
   4. The user’s browser type.
   5. The user’s operating system type.
   6. Date and time of the start and end of a user session.

These technologies can be disabled provided you use a web browser with private browsing and enable it.